CVE-2026-22745: Spring MVC/WebFlux DoS Vulnerability

CVE-2026-22745 Overview

CVE-2026-22745 is a Denial of Service vulnerability affecting Spring MVC and Spring WebFlux applications that serve static resources from the file system on Windows platforms. When exploited, an attacker can send specially crafted malicious requests that are slow to resolve, keeping HTTP connections occupied and eventually exhausting server resources, leading to service unavailability.

The vulnerability requires a specific combination of conditions to be exploitable: the application must use Spring MVC or Spring WebFlux, serve static resources from the file system, and run on a Windows platform. When all these conditions are met, the application becomes susceptible to resource exhaustion attacks.

Critical Impact
Attackers can cause Denial of Service by sending malicious requests that exhaust HTTP connections, making the application unavailable to legitimate users.

Affected Products

Spring MVC applications serving static resources on Windows
Spring WebFlux applications serving static resources on Windows
Applications using Spring Framework's static resource handling with file system resources

Discovery Timeline

2026-04-29 - CVE CVE-2026-22745 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-22745

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The flaw exists in how Spring MVC and Spring WebFlux applications handle requests for static resources when those resources are served from the Windows file system.

The attack exploits the resource resolution mechanism specific to Windows file systems. When an attacker sends specially crafted requests targeting static resources, the resolution process becomes slow, causing HTTP connections to remain open for extended periods. As these slow-resolving requests accumulate, they consume available connection pools and server threads, ultimately preventing the application from serving legitimate traffic.

The network-accessible nature of this vulnerability means any attacker with network access to the affected application can attempt exploitation without requiring any authentication or user interaction.

Root Cause

The root cause lies in improper resource consumption controls when resolving static file system resources on Windows platforms. The application fails to implement adequate timeouts or resource limits when processing requests for static resources, allowing malicious requests to monopolize server resources. This behavior is specific to Windows due to differences in how the operating system handles file system operations compared to other platforms.

Attack Vector

The attack is conducted over the network by sending HTTP requests designed to trigger slow resource resolution. The attacker does not need any privileges or authentication to exploit this vulnerability. By repeatedly sending these malicious requests, an attacker can gradually consume all available HTTP connections, effectively denying service to legitimate users.

The exploitation technique involves crafting requests that target the static resource handling endpoint with payloads that cause the Windows file system resolution to perform slowly. As these requests hold connections open, the connection pool becomes exhausted, preventing new connections from being established.

Detection Methods for CVE-2026-22745

Indicators of Compromise

Unusual increase in HTTP connection duration for static resource requests
High number of concurrent connections from single IP addresses or IP ranges targeting static resource endpoints
Slow response times specifically for static resource requests while dynamic content performs normally
Thread pool exhaustion warnings in application logs

Detection Strategies

Monitor HTTP connection metrics for abnormal patterns, particularly connections with extended lifetimes to static resource endpoints
Implement rate limiting on static resource endpoints to identify and block suspicious request patterns
Configure alerting on connection pool utilization thresholds to detect early signs of resource exhaustion
Analyze access logs for repeated requests to static resources from the same source with unusual timing patterns

Monitoring Recommendations

Enable detailed logging for Spring's resource handling components to capture request processing times
Set up application performance monitoring (APM) to track connection pool utilization and thread consumption
Monitor Windows system metrics including file handle counts and I/O wait times on affected servers
Configure network-level monitoring to detect connection accumulation patterns indicative of DoS attempts

How to Mitigate CVE-2026-22745

Immediate Actions Required

Review your application's static resource configuration to determine if you meet the vulnerable criteria (Spring MVC/WebFlux + file system resources + Windows)
Implement connection timeouts and request rate limiting at the web server or load balancer level
Consider temporarily serving static resources from a CDN or reverse proxy instead of the application server
Apply the security patch from VMware/Spring as soon as it becomes available

Patch Information

VMware has published a security advisory for this vulnerability. Refer to the Spring Security Advisory for CVE-2026-22745 for official patch information and remediation guidance. Apply the latest security updates to your Spring Framework dependencies as recommended in the advisory.

Workarounds

Configure connection timeouts at the reverse proxy or load balancer to prevent long-running connections from exhausting resources
Move static resources to a dedicated CDN or separate web server that is not affected by this vulnerability
Implement request rate limiting specifically for static resource endpoints to prevent abuse
If possible, migrate static resource hosting away from Windows file systems to alternative storage mechanisms

bash

# Example nginx configuration for connection timeout and rate limiting
# Add to your nginx.conf or server block

# Set connection timeout to prevent long-running connections
proxy_connect_timeout 30s;
proxy_read_timeout 30s;
proxy_send_timeout 30s;

# Rate limiting zone for static resources
limit_req_zone $binary_remote_addr zone=static_limit:10m rate=10r/s;

# Apply to static resource locations
location /static/ {
    limit_req zone=static_limit burst=20 nodelay;
    proxy_pass http://spring_backend;
}